-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper whitespace handling in JWT role claims. The HTTPJwtAuthProcessor class in the security plugin's JWT authentication module is responsible for processing these claims. The role processing function would logically contain the string manipulation (trimming) that creates the vulnerability. This matches the CWE-269 (privilege management) and CWE-287 (authentication) classifications, as improper normalization of role names during authentication leads to privilege escalation. The confidence is high because the vulnerability description explicitly identifies JWT role claim processing as the flawed mechanism, and this class is central to that process in OpenSearch's security plugin architecture.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.opensearch.plugin:opensearch-security | maven | < 1.3.8 | 1.3.8 |
| org.opensearch.plugin:opensearch-security | maven | >= 2.0.0, < 2.5.0 | 2.5.0 |
Ongoing coverage of React2Shell